Add CLA check

Author: igor.grzankowski

.github/workflows/cla-check.yml

@@ -0,0 +1,89 @@
+name: "CLA Check"
+on:
+  issue_comment:
+    types: [created]
+  pull_request_target:
+    types: [opened, closed, synchronize]
+
+permissions:
+  actions: write
+  contents: write
+  pull-requests: write
+  statuses: write
+
+jobs:
+  cla-check:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check if user is Splunk org member
+        id: check-org
+        continue-on-error: true
+        run: |
+          # Check if the PR author is a member of the Splunk organization
+          if [ "${{ github.event_name }}" == "pull_request_target" ]; then
+            AUTHOR="${{ github.event.pull_request.user.login }}"
+          else
+            AUTHOR="${{ github.event.comment.user.login }}"
+          fi
+          
+          echo "Checking if $AUTHOR is a Splunk org member..."
+          
+          # Check organization membership (returns 204 if member, 404 if not)
+          STATUS=$(curl -s -o /dev/null -w "%{http_code}" \
+            -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" \
+            "https://api.github.com/orgs/splunk/members/$AUTHOR")
+          
+          if [ "$STATUS" == "204" ]; then
+            echo "is_splunk_member=true" >> $GITHUB_OUTPUT
+            echo "✅ $AUTHOR is a Splunk organization member"
+          else
+            echo "is_splunk_member=false" >> $GITHUB_OUTPUT
+            echo "ℹ️  $AUTHOR is not a Splunk organization member"
+          fi
+      
+      - name: Set success status for Splunk employees
+        if: steps.check-org.outputs.is_splunk_member == 'true' && github.event_name == 'pull_request_target'
+        uses: actions/github-script@v7
+        with:
+          script: |
+            // Post success comment
+            await github.rest.issues.createComment({
+              issue_number: context.issue.number,
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              body: '✅ **CLA verification passed** - Contributor is a Splunk organization member. No additional CLA signature required.'
+            });
+            
+            // Set commit status to success
+            await github.rest.repos.createCommitStatus({
+              owner: context.repo.owner,
+              repo: context.repo.repo,
+              sha: context.payload.pull_request.head.sha,
+              state: 'success',
+              context: 'CLA Check',
+              description: 'Splunk org member - CLA not required'
+            });
+      
+      - name: "CLA Check"
+        if: |
+          steps.check-org.outputs.is_splunk_member != 'true' && 
+          ((github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || github.event_name == 'pull_request_target')
+        uses: contributor-assistant/[email protected]
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          # The below token should have repo scope and must be manually added by a maintainer in the GitHub Secrets
+          PERSONAL_ACCESS_TOKEN: ${{ secrets.CLA_ASSISTANT_PAT }}
+        with:
+          path-to-signatures: '.github/cla-signatures.json'
+          path-to-document: 'https://www.splunk.com/en_us/form/contributions.html'
+          branch: 'main'
+          allowlist: bot*,dependabot*,*[bot],renovate*,snyk-bot
+          
+          # the following fields are optional
+          remote-organization-name: splunk
+          remote-repository-name: splunk-operator-cla-signatures
+          
+          # custom messages
+          custom-pr-sign-comment: 'Thank you for your contribution! Before we can merge this pull request, we need you to sign our Contributor License Agreement.<br /><br />**📝 Please visit [Splunk CLA Form](https://www.splunk.com/en_us/form/contributions.html) to sign the CLA.**<br /><br />Once you have signed, please comment:<br />```I have read the CLA Document and I hereby sign the CLA```<br /><br />**Note**: Splunk organization members are automatically verified and do not need to sign.'
+          custom-allsigned-prcomment: 'All contributors have signed the CLA ✅. Thank you!'
+          lock-pullrequest-aftermerge: false